Question

I’m doing this to all strings before inserting them:

mysql_real_escape_string($_POST['position']);

How do I remove the: \ after retriving them?

So I don’t end up with: \”Piza\”

Also is this enough security or should I do something else?

Thanks

Answer 1

use stripslashes() to get rid of the escape character.

Escaping is great. In case the value is going to be integer , I would suggest you do it like:

$value = (int) $_POST['some_int_field'];

This would make sure you always end up with an integer value.